arXiv: 1504.00939v2 [quant-ph] 22 Sep 2015 


Security of Semi Device Independent QKD protocols against detector blinding attacks 


Anubhav Chaturvedi,^ Maharshi Ray,^ Ryszard Veynar,^’[^ and Marcin Pawlowski^ 

^ Center for Computational Natural Sciences and Bioinformatics, HIT-Hyderabad, Hyderabad-500032,India 
^Institute for Theoretical Physics and Astrophysics, University of Gdansk, 80-952 Gdansk, Poland 

While fully device-independent security in BB84-like one way QKD is impossible, it can be guar¬ 
anteed against individual attacks in a semi device-independent scenario, where no assumptions on 
the characteristics of the hardware used are made except for the communication channel for which 
an upper bound on capacity is put. This approach is especially relevant in the context of recent 
quantum hacking attacks in which the eavesdroppers are able to remotely alter the behaviour of the 
devices used by the communicating parties. They are however unable to change the capacity of the 
channel. In this work we study the security of a semi device-independent QKD protocol against 
the detector blinding attacks. We find the critical detection efficiencies required for security for the 
eavesdroppers with and without quantum memory. 


I. INTRODUCTION 

In standard quantum key distribution (QKD) proto¬ 
cols the security proofs assume that the parties have ac¬ 
cess to the correct and exact specifications of the devices 
that they are using. This assumption is quite problem¬ 
atic. First of all it requires putting trust in the manufac¬ 
turer of the devices, which may be not the best idea. The 
supplier can install backdoors, that enable him to com¬ 
promise the security without being detected. Recently 
a lot of attention has been drawn to NSA which con¬ 
vinced RSA Security to set as a default in their products 
DuaLEC_DRBG pseudorandom number generator which 
is considered to have such a backdoor[T]. Moreover, even 
if the manufacturer is honest, recent advances in quantum 
hacking [2] show that the adversary can remotely influ¬ 
ence the behaviour of the devices during the protocol, 
effectively changing their characteristics. To cope with 
this issue the device independent (DI) approach has been 
introduced. There it was argued that if the parties vio¬ 
late Bell inequalities then, regardless of how their devices 
managed to do this, they can establish a secure commu¬ 
nication. Although the term ”DI” was first used in [3] 
the idea can be tracked back all the way to the original 
Ekert’s paper [3]. Unfortunately, DI QKD is extremely 
hard to realize in practice and so far no experimental 
group has been able to do this. The main reason for this 
is so-called detection efficiency loophole [5], which states 
that if the probability of registering a particle by the de¬ 
tectors used in the experiment is below a certain (usually 
very high) value then the results of the experiment are 
inconclusive, in other words: local, realistic description 
of its results cannot be ruled out. Ruling out this de¬ 
scription in a necessary, although not always sufficient, 
condition for DI security. Another problem faced in this 
scenario is that it can be applied only to protocols based 
on entanglement which are much more complicated than 
prepare-and-measure ones like BB84 [^. 

These two issues are addressed in the semi-device in- 
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dependent (SDI) approach [7]. There a prepare-and- 
measure scenario is considered and again no assumptions 
are made on the inner working of the devices used. Prefix 
”semi” is warranted by the fact that an upper bound on 
the capacity of the communication channel is made. As¬ 
suming this bound is well justified for both honest and 
dishonest manufacturer. In latter case the parties can 
study the devices delivered and, while it is almost im¬ 
possible to fully characterize them, it is much easier to 
establish the effective dimension of the Hilbert space in 
which the states are being prepared. When the supplier is 
honest but the protocol is subject to a quantum hacking 
attack, the limitations on the technology available to the 
eavesdropper make increasing the channel capacity ex¬ 
tremely difficult. In fact, to our knowledge, all the quan¬ 
tum hacking attacks published so far did not increase this 
capacity. Also, because only one side employs the detec¬ 
tors, the requirements on their efficiency are lower than 
in the DI case. 

Another relaxation of the DI paradigm is 
measurement-device independent (MDI) scenario 
mm- There three devices are used. Two communi¬ 
cating parties, with perfectly characterized hardware 
are sending the particles to the third one which makes 
the measurements. We do not make any assumptions 
on the properties of the third device. The difference 
between MDI and SDI scenarios is that the former one 
is more complicated (ie. requires more devices and more 
sophisticated measurements) and does not allow for 
any changes in the preparation devices (which is a big 
disadvantage because even small changes can lead to the 
loss of security [IQ]). On the other hand, it was shown 
[5] that MDI scenario thwarts quantum hacking attacks 
for any efficiency of the detectors. 

The aim of this paper is to establish the critical de¬ 
tection efficiencies for the SDI case. We start by defining 
the classes of attacks against which we want to be secure. 
We consider individual attacks in which evesdropper has 
or does not have access to quantum memory. Then we 
take the most well-known SDI QKD protocol [7] and cal¬ 
culate the detection efficiencies required in both cases. 
Next we propose a modification of this protocol which 
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substantially reduces these requirements. 

II. DEVICE CONTROLLING ATTACKS 

In papers nms] authors gave a simple description of 
the blinding attacks based on detection efficiency loop¬ 
hole. They also experimentally showed that the idea can 
be successfully implemented for various protocols. As¬ 
sume that Eve has perfect detectors while Bob’s have 
50% efficiency. Eve intercepts the signal sent form Al¬ 
ice to Bob who are communicating via BB84 setup and 
measures it. After that Eve encodes her detection results 
into specially tailored bright pulse of light and resends it 
to Bob. Because of physical properties of the signal and 
his detectors Bob will only have a detection result if his 
measurement is in the same basis as Eve’s. It means that 
detectors used by Bob will work with 100% efficiency if 
Eve’s and Bob’s settings are the same and will not work 
at all in the other case. On average detectors will work 
with 50% efficiency which does not cause any suspicions. 
After the raw key exchange, Bob and Eve have identi¬ 
cal bit values and basis choices which after sifting, error 
correction and privacy amplification made by classical 
communication allows her to get the identical final key. 
This is how Eve, by active control of a detector used by 
Bob can secretly learn exchanged key. More about that 
type o control can be found in m- 

In [TU] a different approach is presented. Here Eve 
apart from exploiting her possibility of interfering dur¬ 
ing the calibration of Alice’s device introduces a slight 
modification in it. 

These examples show the need for more general se¬ 
curity conditions where Eve is quite powerful and can 
influence all the devices used in the protocol. However 
there are natural limits to what she can do. Her modifica¬ 
tions should not be significant in order to avoid detection, 
e.g. she cannot make the device use additional degree of 
freedom of the communicated system to encode more in¬ 
formation as this would require introducing a lot of new 
elements into the device. This justifies taking the SDI 
approach in which we assume that the eavesdropper can 
change the characteristics of the devices used but cannot 
increase the dimension of the system sent by Alice. 


III. SDI SECURITY AND ASSUMPTIONS 

DI QKD protocol bases its security on violation of 
some Bell inequality m associated with the scenario. 
Key rate, in this case, can be maximized by reaching the 
quantum bound of this inequality. On the other hand, 
SDI is a prepare and measure key distribution protocol 
with the fixed dimension of the communicated system 
between Alice and Bob [7] . To be more precise this limi¬ 
tation is just for dimension of the signal emitted by Alice 
and doesn’t has to hold for what Bob is receiving. This is 
the most advantageous case for Eve, which furthermore 


reflects the fact that in blinding attacks the pulse sent by 
her to Bob’s lab carries substantially more than one bit 
of information. 

SDI QKD scheme bases its security on beating the clas¬ 
sical bound on efficiency of a related communication com¬ 
plexity task. In [7] the task used was a 2 —1 Quantum 
Random Access Code (QRAC)[T2]. In it Alice encodes 
her two input bits ao,ai € {0,1}^ into a qubit Pao.ai- 
Bob gets only one input bit b G {0,1} and chooses his 
projective, measurements based on it. His task is 
to return B = ah with as high average probability as 
possible. In the QKD protocol after many subsequent 
rounds of the QRAC Bob announces his choice of b for 
each round. The Of, is kept secret and as the bit of key 
for that round. 

do di h 
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FIG. 1. SDI protocol based on 2 —> 1 QRAC without Eve. 

Probability for Bob to obtain (for fixed settings ao,ai 
and b) the result i is P{B = i|oo, ai, 6) = pao^ai) 

for i G {0,1}. Here, are projection operators such 

that X]iG{o 1 } = I- The security parameter in this 

case is an average success probability for 2—^lQRAC. It 
is given by 

Pb = ^ ^ P(P = Ob|ao,ai,6). (1) 

ao,ai,fce{0,l}^ 

Alice and Bob can now establish a secret key by keeping 
Of, after Bob reveals his choice b for each round. The key 
rate can be as high as /(A : P) = 1 — H{Ph) if Eve does 
not interfere. 


IV. ANALYSIS OF THE ATTACKS 

We make the following assumptions about the attacks 
of Eve: 

1. She cannot influence the dimension of the system 
leaving Alice’s lab 

2. She performs individual attacks 

3. Eor each bit of the key the whole information she 
has about it is stored in a bit representing her best 
guess of this bit (this models the situation in all 
proposals for blinding attacks) 
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4. Bob’s and Alice’s devices are controlled by Eve (she 
can make detectors work with 100% efficiency if she 
chooses to) 

In this part of the paper we analyze two types of at¬ 
tacks on SDI protocol based on 2—QRAC. 

1. Intercept/Resend (without quantum memory). 

2. Delayed Measurement (with POVM and a qubit of 
quantum memory). 

First attack due to its simplicity allows us to determine 
security conditions analytically. This is because we take 
Eve’s measurements to be projective and she is the only 
one who sends information to Bob which makes it quite 
easy to parameterize (Figj^. Later we extend the formal¬ 
ism and show that POVM measurements and quantum 
memory gives no advantage to Eve. 

A. Intercept/Resend (IR) 


According to assumption 4 Eve, for given rj can design 
in advance all the states Pao,ai and all measurements 
and Mjf. However, in any given round of communication 
she is not aware of values of ai, 02 and b having just e 
chosen by her. 

Here, are projective operators satisfying 

EiG{ 0 ,i} = E*g{ 0 .i} = I' ^ob’s outcome 

probabilities are given by 

P{B = i\ao,ai,e,b,E) = Tr{M^E''Pao,ai,e,E)- (3) 

As Bob does not know Eve’s output, we can obtain the 
probabilities by summing over the values of E which gives 

P{B = i\ao,ai,e,b) = 

P{E = j\ao,ai,e)P{B = i, E = j\ao,ai,e,b) = 

ielo.i} 

y] Tr(Mf=Vao.ajrr(Mi^rMf=V,„,,J. (4) 

i6{0.1} 


Eve intercepts the signal transmitted from Alice to Bob 
and measures it according to her input e S {0,1}. This 
input is not absolutely necessary for our analysis but we 
introduce it to better model blinding attacks. It repre¬ 
sents Eve’s guess of what the input of Bob is going to be. 

It also allows us to be more general. In this work we as¬ 
sume ’’free will”, i.e. that e and b are uncorrelated but in 
general it is possible to study models when this assump¬ 
tion is partially relaxed and measure Bob’s ’’free will” 
by amount of correlations between e and b. Note that 
Eve being able to choose different detection probabilities 
for rounds when e = b and e ^ b artificially introduces 
correlations between e and b at the level of postselected 
rounds of experiment. 

Eve uses the measurement and obtains an output 
bit E S {0,1}. At this stage we can write Eve’s proba¬ 
bilities of getting E = i as 

P{E = z|ao,ai,e,5) = P{E = z|ao,ai,e) = Tr{M^=^ pao,ai) 

( 2 ) 

where the first equality is because of the fact that Eve 
gets her outcome E before Bob inputs b. Here, are 

projection operators such that X)iG{o 1 } = I- 


Success probabilities can be derived by taking an av¬ 
erage over ao and oi and by the fact, that both. Bob and 
Eve are interested in finding value of at, (i = at). We can 
write those probabilities in a simplified notation as 

^ = «b|e,ao,ai) (5) 

ao,ai 

^ E = (6) 

ao,ai 

Next we split Bob’s detector efficiency rjavg = P{Click) 
into 

p = P{Click\e ^ b) 

Pe=b = P{Click\e = b). (7) 

At this point Eve maximizes Pe=b making it 1 as she 
wants Bob’s device to return the outcomes as often as 
possible when she managed to guess his input. She also 
tries to minimize p. Only thing limiting her in doing so 
is the observed detection efficiency which can be easily 
verified by the users. P{b) = P{b = e) = ^ since Eve has 
no control over Bob’s settings. This leads to 
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Pavg = • (8) 

In this case observed success probabilities for Bob and 
Eve, postselected to rounds when Bob’s detector regis¬ 
tered a particle can be represented as weighted averages 
over inputs e and b 

PEiv) = {Pi + pPk + vPko +Pk)- ( 9 ) 


FIG. 2. IR attack implementation. 

Eve then sends the state Pao,ai,e,E=i = with 

probability P{E = i|ao,ai,e) for i G {0,1} as it repre¬ 
sents her best knowledge about Alice’s input. 


Pb{v) - 2^2 -p p) 

Alice and Bob can establish a secret key if Shannon’s 
mutual information between Alice and Bob is greater 
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than between Alice and Eve {I {A : B) > I [A : E)). 
Assumption 3 allows us to simplify this condition to 

Pb{v)>Pe{v) (11) 


Therefore whenever Pb{v) is higher than maximal suc¬ 
cess probability achievable by Eve P^°‘^{r]) protocol is 
secure. The optimization problem than boils down to 
finding 


= max 


Pk + yPk+yPk + Pk 
2(1 + ^) 


( 12 ) 


piTiax 
^ E 



with = 1 X)aoai ^^(Paoai Afe^““'’) and the maximiza¬ 
tion is taken over all possible measurements of Bob, Eve 
and preparations of Alice. Here we consider two cases: 

1. Because of the fact that manipulations in Alice’s 
lab are much more difficult for Eve than just taking 
control over Bob’s lab by hijacking the signal, we 
start with an assumption that Eve cannot modify 
the encodings chosen by Alice. The states are fixed 
as 


Poo — |0)(0|; 

Poi = ^(|0) + |l))((0| + (l|), 

Pio = ^(|0)-|l))((0|-(l|), 

Pii = |l)(l| (13) 


which is an optimal set of states for the standard 
2—>1 QRAC. To find the maximum, projective mea¬ 
surements Mf has to be characterized by vectors 
from the same plane as the states (13). Then for 
Mf = |Mf )(Mf I we have 


FIG. 3. Maximal success probability for Eve for SDI QKD 
based on 2 —> 1 QRAC. Alice and Bob can verify security 
for any observed efficiency rjavg and Bob’s success proba¬ 
bility {Pb) against the maximum success probability of Eve 
{Pr^na.g)). 


where Oaoai and /3aoai are chosen in advance by 
Eve. Plugging it, together with measurements 


|Mf=°)=cos^|0)+e^^«sin|l|l) 

(17) 


into (12) we can define, for every rj G (0,1), a max¬ 
imization problem over 12 independent variables. 
After performing numerical optimization we ob¬ 
tained the same results as our analytic calculations 
yield for the case without tampering with Alice’s 
device (15). 


These two cases show that controlling Alice’s device 
in a protocol based 2—:>! QRAC does not lead to any 
improvement for Eve. 


|Mf=0)=cos^|0)+sin^|l) 

|Mf=i) = (14) 


This description allows us to simplify equation (12) 
to 


pmaa;(^) ^ 1 ^2-I-cosa^-b sina^^ (15) 

where an = arctan and rj e [0,1]. By using 

t it can be easily transformed into (rjavg) 

ich is a function of the observed detection effi¬ 
ciency. It is plotted in Figj^ 

2. In the second case a more powerful Eve fixes Alice’s 
states to Pao,ai = |ao,ai)(ao,ai|. We parameterize 
them by 


B. Delayed Measurement (DM) 


Now let us consider a more general approach where 
Eve is equipped with quantum memory of a single blank 
qubit pbiank (per signal). This description covers POVM 
measurements as well. After receiving the signal from 
Alice, Eve without any knowledge about Bob’s selection 
of 6 S {0,1} performs unitary transformation Ue on both 
qubits 

Pag,a\,e — UePag,ai ^ Phlank Ul (18) 


After this operation, she forwards to Bob the first sub¬ 
system keeping the second one. Eve does not receive 
any output at this point and delays the measurement on 
her particle until Bob publicly announces his setting b 
(Fig^. Bob’s projective measurement and Eve’s 
measurement are designed by Eve to violate (11). 
The probabilities can be written as 


|ao«i) = cos ■ 


-|0) -b sin 


Q!q 


-|1) (16) 


P{E = i\ao,ai,e,b,B) = ’ 


0^e^JPao,ai,e)- 

(19) 
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FIG. 4. DM attack implementation. 


Because Eve does not know Bob’s outcome, we can 
sum over the values of B and obtain 


P{E = i\ao,ai,e,b) = ^ ’■ (g) M^t,)pao,aue) 

BG{0,1} 

= rr((M,^r ® (20) 

Bob’s success probability can be expressed as 

P{B = i\ao, ai,e, b) = Tr{M^jg’-TrE{pao,ai,e))- (21) 


To write formulas for observed probabilities we can use 
the same notations for Bob as before (|^. Because of 
delayed measurement made by Eve we allow her proba¬ 
bilities ([^ to depend on b. With this little extension and 
by taking i = ah we can define Psiv) 8-nd Psiv) in the 
same way as ^ and (101 respectively. 

We have numerically optimized the guessing probabil¬ 
ity of Eve in this case and again obtained the same result 
as in the simplest case with IR attacks and no manip¬ 
ulation of Alice’s device (Figj^. We conclude that nei¬ 
ther quantum memory with a more general measurement 
approach nor control over Alice’s device does not give 
any advantage to Eve over controlling only the device of 
Bob. With the maximum quantum success probability 
Pb ~ 0.85 the security of this protocol against individ¬ 
ual attacks of all the classes studied here is 50%. Now we 
modify the protocol to see if we can lower this number. 


V. MODIFIED SDI PROTOCOL 

Here we present SDI protocol based on 3—>-1 QRAC 
which is a straightforward generalization of the one from 
[7] and study its security against both types of attacks. In 
a 3—>-1 QRAC Alice is given three bits ao, ai,a 2 € {0,1}^ 
depending on which she sends the state Pao, 01 , 02 ) while 
Bob gets a classical trit, b G {0,1, 2} and is required to 
guess the value of at- Bob’s final output is B G {0,1} and 
the success probability is labeled by Pb = P{B = ab). 
Eve wants to learn the bit Of, in order to establish the 
same key with Alice as Bob. 
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FIG. 5. SDI protocol based on 3—>1 QRAC without Eve. 


The whole structure, reasoning and notation (IR and 
DM) form SDI protocol based on 2—i-I QRAC is kept. 
The average detection efficiency of Bob’s detector is given 
by 


Vo,vg — 


l-h277 

3 


( 22 ) 


Eve’s success probability, because of a larger number of 
settings is now 


PeIv) - 3 ^^ 2ri) {^^0 + Pe2) + 

Pei + v{Peo + PE 2 ) + Pe2 + viPsi + Peq)) ■ ( 23 ) 


where for IR = b Eapaia 2 Tr{pa,a,a 2 M^-‘^»). Anal¬ 
ogous formulas can be written for Pb(j]). Here optimiza- 
tio n pr oblem can be solved by finding maximum P^°‘^{rf) 
of g with P4 = |Eaoaia 2 ^KPa„aia 2 Mf=“Q. The 
maximization is carried over all states Paoaia 2 and mea¬ 
surements Again we can analyze two cases: 


1. States emitted by Alice cannot be manipulated by 
Eve. Alice fixes them as 


1000 ) = | 0 ), 

| 001 ) = ^| 0 ) + ^| 1 ), 

|010) = ^|0)+P^'^|1), 

|I00) = ^|0)+e-^'^|I), 

|I11) = |000)^ 

|I10) = |001)^ 

|I01) = |0I0)^ 

|011) = |100)^ (24) 

where Paoaia 2 = 1000102 ) ( 000102 !. These states are 
an optimal encoding for the standard 3—>-1 QRAC. 

For measurements |) 

we use general parametrization 

|Mf=°)=cos^|0)+P^=sin|^|I) 


( 25 ) 
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Encoding of Alice’s states used here imposes sym¬ 
metry by which the maximum value of PE{fl) is 
given if /3o = f, /3i = — f and /32 = tt. After 
substituting it to (23) we obtain 




1 

6 


^3 + cos 


l + 2ri 



(26) 


where = arctan ^ . This is presented as 

a lower line of the plot Figj^ 

2. Analogously as before, we now assume that Eve can 
secretly change the way Alice’s states are prepared. 
We start with simplified parametrization of Alice’s 
encoding as 

1000 ) = | 0 ), 

|001) =cos||0) -hsin||l), 

|010) = cos ^|0) -I- sin ^|1)) 

1100 ) =cos||0) +e"*^sin||l), 

| 111 ) = | 000 )^ 

| 110 ) = | 001 )^ 

| 101 ) = 1010 )-^ 

|011) = |100)-^ (27) 



FIG. 6. Maximal success probability for Eve for SDI QKD 
based on 3—>1 QRAC vs. r]avg (the upper line). Alice and 
Bob can verify security for any observed efficiency r^avg and 
(observed) Bob’s success probability (Pb) against the maxi¬ 
mum success probability of Eve {Pis°'^iVavg))- The lower line 
describes maximal probability for Eve who cannot change the 
states PaQ,ai,a2- 


where N{ri) = 

After this we can move on to a more general de¬ 
scription of Paoaiaa = 1000102 ) ( 0901021 where every 
vector |aoOi 02 ) is parameterized as 

cos | 0 ) + sin |1). (32) 


where a and j3 are parameters controlled by Eve. 
In this case optimal encoding for standard 3—>1 
QRAC is reproduced for a = arccos | and fi = 
27r/3. 


After substituting it together with measurements 
(251 to (231 we maximize it over two parameters 
which leads to the solution. For ry G (0, 

Eve’s success probability is given by 


P >max ( 
E 


( 77 ) = -I- (1 -I- cos a,,) cos/3^ -|- 


2 ( 1 - 7 ;) 

l-b2r; 


sin 



(28) 


This increases the number of parameters controlled 
by Eve to 22. By numerical maximization we ob¬ 
tained the same limit as for the case with simpli¬ 
fied parametrization \27\ presented earlier. Here 
by tampering Alice’s device Eve is able to visibly 
improve (see Figj^. 

We have analyzed the case of DM attack against this 
protocol as well. We used analogous formulas to (20) and 


(21). By adapting previous algorithm to protocol based 


on 3—>1 QRAC and running it over all parameters con¬ 
trolled by Eve we reconstructed lines presented in Fig|^ 
The security conditions for DM attack are again the same 
as for IR attack. 


and for rj € ( ^^ 1) by a constant value 

Pr^iv) = (29) 

Here 


arj = arccos 


A7(r;)2 _ 1 


(30) 


Prj = arctan 


tan(Qf,,) 

N{r]) 


(31) 


VI. CONCLUSIONS. 


In this paper we analyzed individual quantum hacking 
attacks on SDI protocols based on QRACs where Eve 
can control all devices in use. Looking at these types 
of attacks was motivated by their recent experimental 
realizations. We have also shown that access to small 
quantum memory does not help the eavesdropper at all 
and conjecture that more memory does not change this 
state. 
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We analyzed two protocols. For SDI based on 2— 
QRAC Eve is not able to improve her situation by tak¬ 
ing control over Alice’s device which is quite surprising. 
Taking control only over the signal and Bob’s detectors 
is the optimal attack for her and the critical detection ef¬ 
ficiency, which depends on Bob’s success probability, can 
be as low as 50%. 

Changing SDI protocol into one based on 3—>1 QRAC 
decreases the key rate but conditions for success proba¬ 
bility are significantly lowered. Here the critical detector 
efficiency can be as low as 41.2% if Bob’s success prob¬ 
ability reaches quantum maximum. In this example one 


can also see the advantage of manipulating Alice’s device 
which was not the case for the previous protocol. With¬ 
out this manipulation the critical detection efficiency is 
only 38.7%. 
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